c5a370a79ff6ddc135ca93d5f7ee51837057b683af051fbd08b53210c96c1daa

General

Target
waverupee_sl6f1q_N1.1.2-20260422.apk
Size 6.4MB
Sample261006-g3m56ssbrd
SHA256 c5a370a79ff6ddc135ca93d5f7ee51837057b683af051fbd08b53210c96c1daa
MD5 0ecbf8e0325e3e0b59a9ed8dd861f38a
SHA1 4c3908d140779dcef3df3def393820c5d5c7994d
SHA512 a4ac704c8dd58c5bc02c635dc4456ac661e4d92f2c4f392ba92e997a84294c9fd92ea605fcb5139f82bb8a2eec45062399ffad3f6e5b8bd0a18dd3a200ab187f
SSDEEP 196608:LwxSSVkvpqCZ7B/YGq3NETmGf6KO0hhXuq1u:L4SzvpqCZ7Sz3r0hBuq1u
TLSH
T1B566019EF76C791FC87F5032465AC232256A4D158A47EBD71848372DE8776E80F88BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

collection credential_access discovery impact persistence

Malware Config

Signatures

Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs

Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

collection credential_access impact

Clipboard Data

T1414

Transmitted Data Manipulation

T1641.001

description	ioc	Process
Framework service call	android.content.IClipboard.addPrimaryClipChangedListener	com.waverupee.loan

Acquires the wake lock 1 IoCs

description	ioc	Process
Framework service call	android.os.IPowerManager.acquireWakeLock	com.waverupee.loan

Queries information about active data network 1 TTPs 1 IoCs

discovery

System Network Connections Discovery

T1421

description	ioc	Process
Framework service call	android.net.IConnectivityManager.getActiveNetworkInfo	com.waverupee.loan

Queries the mobile country code (MCC) 1 TTPs 1 IoCs

discovery

System Network Configuration Discovery

T1422

description	ioc	Process
Framework service call	com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone	com.waverupee.loan

Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs

persistence

Broadcast Receivers

T1624.001

description	ioc	Process
Framework service call	android.app.IActivityManager.registerReceiver	com.waverupee.loan

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.waverupee.loan

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.waverupee.loan

com.waverupee.loan
1⤵
- Obtains sensitive information copied to the device clipboard
- Acquires the wake lock
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks CPU information
- Checks memory information
PID:5058

Network

MITRE ATT&CK Mobile v16

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1624

Broadcast Receivers

1

T1624.001

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1633

System Checks

2

T1633.001

Credential Access

Clipboard Data

1

T1414

Discovery

System Information Discovery

2

T1426

System Network Configuration Discovery

1

T1422

System Network Connections Discovery

1

T1421

Lateral Movement

Collection

Clipboard Data

1

T1414

Command and Control

Exfiltration

Impact

Data Manipulation

1

T1641

Transmitted Data Manipulation

1

T1641.001

Replay Monitor

Loading Replay Monitor...

Downloads

com.google.android.datatransport.events

Path /data/data/com.waverupee.loan/databases/com.google.android.datatransport.events
Size 56KB
SHA256 d22773b4715d285bceef9dacc4bdc5c695c1b78911c44f1a31e9886e4419ea00
MD5 5266d0074670f24485267098a75c6cc3
SHA1 f0816bb4e04710d85c352daf446fa012753a4717
SHA512 2d085851f52fb315ef3ab95195f120dd75035232135f2aa5fb7333eda9c2d3a176ee02e70ea361aa2ed327fc20c6e780405805e58f291e1b3dbeb53c38f7ccf9
SSDEEP 48:T3g59MENZBdUdndVd/729IvdldHlq8/Jq4qPSo:8MEX0wIyNjao
TLSH
T1A543639D5E3C2221C57E283ED7E143635B7C93DF5723927239908DF98DC206974358A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.waverupee.loan/databases/com.google.android.datatransport.events-journal
Size 512B
SHA256 39ce63748712bdb65719f257cfc9678b396135d2cc7c843a8161241e73bbf0c6
MD5 b8a30e40ae52ed90224a161a26dbeeb3
SHA1 70186a6bd7fdf3938761d4f87af8b8c9e06391d3
SHA512 8e10c039b821927c8b6d75c7dae61848bce2b91bd8acbd8f3bf4950c606ff20ccc9809b15d5e9f4c8bf4fdbcd98a4ec75a792d3b3e85099bc3962e65fd4f0090
MD5 SHA1 SHA512

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.waverupee.loan/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 54b264f1f6291d929a1637e6549e663ef3d3e934ca342f36b5a307070095d4da
MD5 5637fe6d0ac3aea2276e84ed5466e69e
SHA1 d120628ed4610f90f75850cf10499f827b63e674
SHA512 24efe180b613184b0f04938db1d2ed1ed5aca8ccbcc704e57ebf325ccca662e45ff3442402bc2a2baa6442c8641c5b46f3f948bf66b501a6c9bb4e711c7e3d27
SSDEEP 6:7+/l9Yl3Hn1A1Wg9bNFlEuWdOlOERX4PBX4ogLugMBX4suuKgn:7+tn1WqLiuWdwRmBEyPbr
TLSH
T17B02228DE3C50A22C82A26FBA0DA83441D00EB198261CB47166108983D038CCE4F0E08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.google.android.datatransport.events-journal

Path /data/data/com.waverupee.loan/databases/com.google.android.datatransport.events-journal
Size 8KB
SHA256 59ec481bc99dca6f943e86bacf7653f1c74806be5323037368301fb4c0dc3a0c
MD5 d997490eaa8f9cea519af108ebd26c88
SHA1 ef4cfd7933e157ecc6543bb751c97a26437e4dd0
SHA512 9da7915661d264ead3958189e025fbd04ab9101182609c6a54697ce49cde2d5af43b8ae9601869adb90dbd1d3efec5fa1d2f916804d300cad816ecd5cd9fd5d1
SSDEEP 6:7+/l9ltOPg9bNFlLdrlOERX4PBX4ogLugMBX4suuK+XU/f:7+tAqLJdTRmBEyPbPX0f
TLSH
T14C02808BA7810913C51F57B790D983592E50E71DD373CB57256408987C477CCED90D54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PersistedInstallation6267278453611874778tmp

Path /data/data/com.waverupee.loan/files/PersistedInstallation6267278453611874778tmp
Size 90B
SHA256 d1dc06b9c3e5804bc7bee7a747538b58749aca8c90df90ad375ffd9a270cf526
MD5 ee98e80d10139df8f586d2c899f8788a
SHA1 6b09ca1edac75810f531c05e4d55fd24b77f28d3
SHA512 d8213382a1cb1ce542ab6c87e2e87ef99bf495f36eb7be92ebd954b0ce03ce3dac73954a9e1c9782f3e935066f3f73a1cc9394149359c7bd9c567f787e4a8d74
TLSH
T1D7B012444B704183C489E3021C8CE1005DA01581440E8A054A1CE47081C12E98703FF4
MD5 SHA1 SHA512 TLSH

Submit Download

PersistedInstallation8461677725731358411tmp

Path /data/data/com.waverupee.loan/files/PersistedInstallation8461677725731358411tmp
Size 569B
SHA256 f58fb6d88635faa96ecaf19a9fd1c16181594511e9841a8403302a270bdfe8d0
MD5 1c0e12cc1e0147961ed53172baea2375
SHA1 0e05497e6a7879e439cb8581f7e4ecb58b236665
SHA512 463e23bb95416f38b363465b1e7e2de79788449436ed0dbc7953436ac5ddcf09b308569625e7c942de224558727a343f526656098be6de6549a716f667edd3ac
TLSH
T157F096DA3BF0540EE5999702548DFC578CA905A5AD0F31B43CBA8D70D0B8E5F834BE84
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.waverupee.loan/files/behavior_log.txt
Size 68B
SHA256 b783f4de6005e79481fdaab4e462b0e41bc2b2652d01c9d881f080ecf90ba92a
MD5 16c1e67131ccc234032a3fbd5ad6f84c
SHA1 e313093f70b4ef9705c7cbd8e2bb000e63af0bf6
SHA512 1baeffc311b15aed7411cafd823fe92f354fbaaff7a4ae831109147d16678f214b4749dfe6a6a50dd807ada896b0275c1a0afe027498a4aa70915dca78547850
TLSH
T136A022BB202BF030E000020C000C2C30002CF0F002E008A23A00AB308C08C0F8A3BFC0
MD5 SHA1 SHA512 TLSH

Submit Download

behavior_log.txt

Path /data/data/com.waverupee.loan/files/behavior_log.txt
Size 60B
SHA256 d6d34020b854b862934ef801c4adfee321055c866b9a202c7958dd506a52105b
MD5 e34199ef73ce2e254856fb85d1d892c2
SHA1 a83e229c27c3fd0b7a8fa3b9ba5d6cc4604bcbe4
SHA512 520170ee9436c490c678e4ca6c03d1490ce2d7babc63de1a1179472912be9693b19e30f0969be1f22c65ef6240962c7def1c304d596a1580e839da78f9a0610d
TLSH
T1D9A022CB022B80222088200CE08C0808C028C0F020230CB0282083088802B08080BE20
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v16

Replay Monitor

Loading Replay Monitor...

Downloads